ec2_ami: create tags on ami at point of creation

[andytson]

Summary

I am trying to use the principals of least privilege to limit an ansible play in CI to only being able to manage the AWS resources that it itself creates.

I do that by creating a tag on each resource when its created to signify ownership.

on the ec2_ami module, it appears to only create the tags after the image has finished snapshotting. This means:

• if the ansible play fails to complete during snapshotting, the tags are not added
• ec2:CreateAction = 'CreateImage' condition isn't available to be matched by the IAM policy, meaning only a policy that allows tagging all AMIs is possible, breaking the security of it

The CreateImage api call supports passing tag specification

Issue Type

Feature Idea

Component Name

ec2_ami

Additional Information

The following tasks fail on CreateTags with a policy created further down

- amazon.aws.ec2_instance_info:
    filters:
      "tag:example.com/myapp": "true"
      instance-state-name: [ "running"]
  register: aws_instances

- amazon.aws.ec2_ami:
    instance_id: "{{ (aws_instances.instances | first).instance_id }}"
    name: myapp
    wait: true
    tags:
      "example.com/myapp": "true"

policy.yml used to set up the IAM permissions from another set of AWS credentials

- community.iam_policy:
    iam_type: user
    iam_user: myapp
    policy_name: ec2
    policy_json:
      Version: "2012-10-17"
      Statement:
        - Sid: Describe
          Effect: allow
          Action: 
            - ec2:DescribeInstances
            - ec2:DescribeImages
          Resource: "*"
        - Sid: Tagging
          Effect: allow
          Action: ec2:CreateTags
          Resource: "arn:aws:ec2:{{ aws_region }}::image/ami-*"
          Condition:
            StringEquals:
              "ec2:CreateAction": CreateImage
              "aws:RequestTag/example.com/myapp": "true"
        - Sid: CreatingImagesFromInstance
          Effect: Allow
          Action: ec2:CreateImage
          Resource:
            - "{{ aws_ec2_arn_prefix }}:instance/*"
          Condition:
            StringEquals:
              "ec2:ResourceTag/example.com/myapp": "true"
        - Sid: CreatingImagesNewImage
          Effect: Allow
          Action: ec2:CreateImage
          Resource:
            - "arn:aws:ec2:{{ aws_region }}::image/*"

If "ec2:CreateAction": CreateImage is removed, it works due to CreateTags api call being used rather than tags passed into the CreateImage api call.

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibullbot]

Files identified in the description:

• [plugins/action/__init__.py](https://github.com/['ansible-collections/amazon.aws', 'ansible-collections/community.aws', 'ansible-collections/community.vmware']/blob/main/plugins/action/init.py)
• [plugins/modules/ec2.py](https://github.com/['ansible-collections/amazon.aws', 'ansible-collections/community.aws', 'ansible-collections/community.vmware']/blob/main/plugins/modules/ec2.py)
• [plugins/modules/ec2_ami.py](https://github.com/['ansible-collections/amazon.aws', 'ansible-collections/community.aws', 'ansible-collections/community.vmware']/blob/main/plugins/modules/ec2_ami.py)

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibullbot]

cc @Constantin07 @gunzy83 @jillr @lwade @s-hertel @scicoin-project @tgerla @tremble @wilvk @wimnat
click here for bot help

[tremble]

Hi @andytson,

Thanks for the suggestion, I've attempted to add support with #551. Please note that this will only work when creating an image directly from an instance.

If you're able to test the PR that would be appreciated.

[tremble]

@andytson,

While tag-based permissions may be the right solution for your needs, from experience I'd generally recommend considering the use of multiple AWS accounts rather than relying on tag based permissions. AWS Organizations, sharing subnets between accounts and transit gateways make this much easier than it used to be. My experience with tag-based permissions is that they can get very complicated to maintain in the long run.